https://pulumi.com
Join Slack
This message was deleted.
# kubernetes
s
This message was deleted.
b
wow, you’re right. it happens here too. looks like Pulumi uses 
kubectl apply
to apply the secret, which makes . The “correct” way to do it seems like it would be to use 
kubectl create
the first time, and then 
kubectl replace
on subsequent updates, which does not retain a 
last-applied-configuration
annotation (ref https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/) would you like to make a github issue? 😄
l
b
awesome work 👍
l
I added the pulumi & k8s provider versions to the ticket.
👍 1
b
hopefully someone who knows how this works will pick up on it soon. I have a feeling it’s going to have to be fixed in the terraform provider though…
l
@broad-helmet-79436 don’t think so as the Pulumi k8s provider is one that doesn’t depend on the TF provider. 😉
b
oh, you’re right!
fingers crossed this can be resolved quickly then. good catch 🙂
l
@gorgeous-egg-16927 if you have a minute, I would like to discuss a bit regarding the issue I filed on GH. For me, the issue is the annotation which is added, I guess by Pulumi.
g
Sure, interested to hear more
l
I would like to find out about the difference in the two scenarios: 1. I create a secret via CLI: 
kubectl create secret …
and with 
kubectl get secret ...
I get a secret without annotation. 2. I create a secret via Pulumi. With 
kubectl get secret
I get a secret with the annotation. So is Pulumi doing something different from the CLI?
g
Generally 
kubectl
adds the same annotation, but it might not for Secrets; I’d have to check. Pulumi’s k8s provider adds that annotation to help with client-side diffing.
It should be compatible with `kubectl`’s usage
Huh, just confirmed that 
kubectl
doesn’t add that annotation. Wasn’t aware of that before.
l
@gorgeous-egg-16927 so is the GH issue I filed a bug then which will be fixed? It’s a small thing in the end, given that the secret data is only base64 encoded.
g
I’m chatting with my colleague about it now. It might make more sense for us to always replace Secret resources on update, and get rid of the annotation.
Let’s keep the issue open for now, and I’ll update with any new info
👍🏼 1
4 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by